Skynet: hackers are going after your AI, and you foot the bill

Someone is using your AI service to power cyberattacks. The usage ends up on your bill. That's how LLMjacking works, as described by Symantec in research published on 21 October 2026: an agent looks for exposed models and tries to use them as its operational engine.

What they found out about Skynet

The instructions collected by the researchers called for scanning, credential theft and installing software to mine cryptocurrency. A mode called Skynet authorised up to 100,000 steps without human approval.

The 100,000 steps are a limit in the instructions, not successful attacks. Symantec collected them over the summer using a decoy service, a honeypot, which did not run the requested tools: the full compromise chain was not demonstrated.

Which services can be involved

The risk concerns AI models and gateways reachable without authentication or with stolen credentials, including test environments.

For a company experimenting with AI, the useful question is very concrete: who can use our integrations, and with what permissions? A prototype belongs in the service inventory, with an owner, defined access and a procedure for shutting it down.

An assistant should have the permissions its job requires

Picture an assistant that looks up information in the company catalogue. To answer questions about products, reading that data is all it needs. If the same integration can modify orders, delete documents or run commands on the server, a bad request can have far wider consequences.

OWASP names this risk excessive agency: too much autonomy, functionality and permissions. The controls also have to live in the connected systems: a read-only account must stay read-only regardless of what the model decides to ask for. Operations with significant consequences require an approval verified by the application.

Five questions to ask whoever manages your AI integrations

1. Which services are reachable from outside? Ask for a list that includes prototypes and test installations, with their access controls.
2. Does each integration have its own credentials? Separate keys and limited permissions let you revoke a single access. The OWASP Secrets Management Cheat Sheet also covers rotation, revocation and usage tracking.
3. What can the assistant do in the connected systems? Have them distinguish between reading, modifying, deleting and sending data. Access should be limited to the functions that are needed.
4. How are unusual usage and access detected? Ask who receives the alerts and how they can step in. A configured budget needs checking: you need to know whether it blocks usage or only sends a notification.
5. How is abusive usage stopped? There needs to be a procedure to revoke the affected credentials, preserve whatever traces are available and restore the integration once it has been checked.

A concrete check for your company

If you use chatbots, automations or assistants connected to documents and business systems, we can help you map out access, credentials and permissions. We start from what you already have: which integrations are active, what data they can reach and who controls how they're used.

The result is a list of checks and actions with clear priorities, which you can also agree on with your current provider. See how we work on AI solutions for businesses in Ticino.

Let's talk about your AI integrations↗

For urgent runtime updates, also read our article on the PHP and Node.js vulnerabilities of October 2026.

Original illustrative diagram by Webcracy.